Information on the protection of personal data

(Pursuant to European Regulation No. 679/2016 and Italian Legislative Decree no. 196/03 and subsequent amendments and integrations)

Pursuant to current national and Community legislation on the protection of personal data, we propose below the information regarding the processing of personal data collected. The processing of personal data will be carried out in compliance with the rights and fundamental freedoms of the data subject in accordance with the principles of correctness, lawfulness and transparency.

Data controller

The Data controller is:
– Ventura S.p.A.
– Viale Sarca n. 336, Milan;
– privacy@venturatravel.it

Purpose and legal basis of the processing

The processing of personal data will be carried out by the Company, according to the scope and nature of the processing, for the following purposes:
a) Delivery on behalf of clients of services connected to requests for travel arrangements, participation in meetings, events and / or sporting events, with reference to the activities of ticketing, booking and coordination of accommodation and transfer services, issuing of insurance policies.
b) Measuring levels of customer satisfaction in relation to the quality of services rendered through the use of contacts provided.
c) Sending communications of a promotional, advertising or commercial nature.
d) response to requests for information sent through forms and contact details on the websites of Group companies;
e) sending of newsletters following the user’s registration to mailing lists available on the websites.

The processing of personal data holding by the Company, also linked to particular categories of data, for the purposes referred to in subparagraph a) is carried out in execution of the agreement signed with the interested party,¬†and on the basis of your explicit consent, according to which Ventura S.p.a. is the data controller. While processing for the purposes referred to in letters b) c), d and e) is carried out on the basis of the interested party’s explicit consent.

Nature of the data transfer

The communication of some of the data for the purposes referred to in point a) is necessary to implement the agreement with the data controller. The transfer of peculiar categories of data (for example food preferences, information on the state of health, etc.) is not mandatory but any refusal to provide certain data or refusal to consent to their treatment, could result in the failure or partial performance of the related services.
The consent for the purposes referred to in subparagraphs b) and c), on the other hand, is completely optional and any refusal will not have any consequences on the provision of the services requested.

The communication of data and consent to the processing by the interested party for the purposes d) and e) is optional but at the same time is a necessary condition for the provision of the service.

Recipients / categories of recipients

Data will not be disseminated and, in relation to the purposes referred to in letter a), may be disclosed to:
– airlines, hotel chains, car rental companies, Global Distribution Systems (GDS), any other providers of services required in order to make it possible to provide the service further;
– companies of the BCD Travel Group, for purposes instrumental to the fulfilment of company activities such as reporting for invoicing purposes, within the limits in which the processing is necessary for the execution of the obligations deriving from contracts with such companies.
For the purposes referred to in letter b) data may be disclosed only in aggregate and anonymous form, and may be disclosed, depending on the scope of the processing and the nature of the respective contractual relationship, to BCD Travel Group Companies and / or customers of Ventura S.p.a. with which it has relationships of supply or management of services, for purposes of statistics and monitoring, as well as performance and verification of the quality of the services provided.
The data referred to in letter c) of the aforementioned purposes could be subject to disclosure, for the implementation of marketing campaigns and for the occasional sending of advertising and / or informative material.
Processed data acquired for the purposes referred to in letters d) and e) will in no way be disseminated and will be processed only by personnel appointed for this purpose by the Data Controller.

Data transfer abroad

Data collected may be transferred to a third country, even outside the European Union, if it becomes necessary for the execution of the agreement between the data controller and the data subject.

Automated decision-making processes

The Controller does not use automated decision-making processes with respect to the data subject’s personal data.

Data retention period

Data for the purposes referred to in letter a) will be stored for the time necessary for the purposes for which it was collected and the management of the contractual obligations on which the processing is based, as well as the carrying out of accounting and tax purposes as provided by the law.
Data relating to your level of satisfaction with regard to the purposes referred to in letter b) will be stored for the time necessary to pursue the aforementioned purposes and in any case not later than the time necessary to make it anonymous.
The contact data on which you consent to receive information for the purposes referred to in points c) will be used for no more than 24 months from the moment it is obtained.
Data collected for the purposes referred to in letter d) will be stored for a period not exceeding 6 months and, in any case, no longer than the time necessary to it anonymous.
Lastly, data provided by the interested party for signing up to the mailing lists referred to in letter e) of the aforementioned purposes will be retained and used by the data controller until the cancellation of the service or the request to end their subscription to the mailing list by interested party.

Rights of the interested party

At any time, the interested party may exercise his / her rights, listed below, according to the provisions of national and European laws.

– Right to access: the interested party has the right to obtain confirmation of whether or not personal data processing is occurring and, in this case, to obtain access to personal data. It is possible to request access to the following information at any time: the purposes of the processing, the categories of data processed, the recipients to whom the personal data is or will be disclosed, the storage period, the existence of rights in your favour, the origin of the data and the possible existence of an automated process.
– Right to rectify: the data subject has the right to request from the data controller the correction of inaccurate personal data concerning him/her without undue delay. Furthermore, he / she has the right to update any incomplete personal data, also by providing an additional statement. In this case, the data controller will be obliged to inform each recipient to whom the personal data has been transferred concerning any corrections.
– Right to delete: the interested party has the right to delete personal data concerning him/her without undue delay and to request deletion. In addition, if his/her data has been made public, the data controller will delete it and take reasonable steps, including technical ones, to inform data controllers who are processing the personal data of the request of the interested party to delete any copies of his/her personal data.
– Right to limit processing: if the interested party deems it appropriate, he/she may request to limit the processing of personal data concerning him and limit its processing in the future. In this case the data controller will notify to each of the recipients to whom the personal data has been transferred any processing limitations, unless this proves impossible or involves a disproportionate effort
– Right to data portability: the data subject has the right to receive personal data relating to him/her in a structured, commonly used and readable form by automatic device and to request storage for further use for personal purposes. Furthermore, the data subject has the right to request the direct transfer of his/her data to another data controller without impediments, where this is technically possible.
– Right to object to the data processing: the data subject has the right to object at any time, for reasons connected with his particular situation, to the processing of personal data concerning him / her.
– Right to withdraw consent: in the case of processing based on consent, the interested party may revoke the consent granted for processing his/her data. However, this document does not affect the validity of the processing carried out by the data controller up to that time.
– Right to file a complaint to the Supervisory Authority: where the data subject considers that his / her data has been processed illegally in breach of the rules and principles regarding the protection of personal data, he / she has the right to contact the Supervisory Authority (Privacy Guarantor) to file a complaint, according to the procedures defined by the latter.

Date of drafting of this document: 24 May, 2018